codesafe-audit-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CODESAFE_BASE_URL | Yes | CodeSafe base URL | |
| CODESAFE_INSECURE | No | Set to 'true' to disable SSL verification (for isolated environments only) | |
| CODESAFE_PASSWORD | Yes | CodeSafe password | |
| CODESAFE_USERNAME | Yes | CodeSafe username | |
| CODESAFE_CA_BUNDLE | No | Path to CA bundle for self-signed certificates | |
| CODESAFE_ENABLE_WRITE | No | Set to 'true' to enable write operations |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| codesafe_list_tasksA | List quick-check scan tasks. Returns totalCount and quickVOS (each carries taskVO.pkTask / taskName / taskStatus / language, plus owner and time). Use a pkTask as taskId below. |
| codesafe_task_summaryA | Get a task's metadata and code statistics (file/line counts, template, times). |
| codesafe_bug_summaryA | Aggregate defects by rule (from bugType). Use this to pick a rule to audit. Returns per-rule: ruleCode, ruleName, category, severity level, and total. IDs are omitted by default; set include_ids=true to include a bounded sample. |
| codesafe_list_bugsA | Page through defect instances. NOTE: the server endpoint ignores level/ruleCode filtering, so when those are supplied the filter is applied client-side to this single page only (returned count may be < page_size). For a complete filtered set, use codesafe_bug_summary + codesafe_audit_by_rule. |
| codesafe_audit_statusB | Summarize a report's audit progress from the platform auditState field. |
| codesafe_bug_detailA | Get full defect detail: rule definition (desc/solution/CWE), the taint dataflow trace (bugTraces), exact location, and existing audit state. |
| codesafe_bug_codeA | Fetch a range of source lines (1-based, inclusive) for the file behind a bug. The platform ignores the line range and returns the whole file, so we slice the requested [begin_line, end_line] window client-side with line numbers. |
| codesafe_audit_bugA | Assemble a judgment-ready audit context for one defect. Pulls the rule definition + taint dataflow trace + sink code context in one call, reconstructs the source→sink path, and returns it together with the judging criteria and output schema. The verdict itself is produced by the calling LLM (design §8 option A) — nothing is written to the platform. Respond with a judgment following |
| codesafe_audit_by_ruleA | Batch-assemble audit contexts for up to max_n defects of one rule. Resolves the rule's bugIds via codesafe_bug_summary, then builds an audit_bug context for each (capped at max_n and CODESAFE_AUDIT_BATCH_LIMIT). Returns contexts + a summary table skeleton the calling LLM can fill with verdicts. Read-only. |
| codesafe_submit_auditA | Write audit verdicts back to the platform (POST /codesafeapi/result/audit), so the Web UI shows 误报/确认 markers and PDF exports include them.
⚠️ This is the only tool that mutates the platform. Prefer dry_run first, and write in small batches. Each write is verified — if the bug's auditState does not actually change (e.g. ID not resolved), the tool raises instead of silently leaving only a comment. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
Most tools have clear, distinct purposes: listing tasks vs summarizing tasks, listing bugs vs summarizing bugs. However, codesafe_bug_detail and codesafe_audit_bug overlap in providing rule definitions and taint traces, differing mainly in whether sink code and judging criteria are included. This overlap could cause an agent to select the wrong one when a raw detail view is needed versus a judgment-ready context.
All tool names share the codesafe_ prefix and use snake_case, but the internal convention is mixed. Several use verb_noun (list_tasks, list_bugs, submit_audit), while others use noun_noun (task_summary, bug_summary, bug_detail) or verb_preposition (audit_by_rule). This lack of a uniform pattern, while still readable, reduces predictability.
With 10 tools, the server is well-scoped for a code audit domain. It covers task discovery, defect exploration, audit context preparation, and verdict submission without excessive redundancy or trivial tools. The count fits comfortably within the ideal 3-15 range.
The tool set provides a complete workflow: list tasks, get task summaries, aggregate defects by rule, page through individual bugs, fetch detailed defect data, retrieve source code, prepare audit contexts (single and batch), check audit status, and submit verdicts. No critical operations are missing for the stated purpose of auditing code security defects.